CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 23/10/2025 |
| GHSA-q6hv-wcjr-wp8h | LOW | kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace | 26/09/2025 |
| CVE-2025-29922 | CRITICAL9.6 | kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target workspace for pre-existing resources. By design, this should onl | 20/03/2025 |
| GO-2024-3325 | kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp | 12/12/2024 |
| GHSA-c7xh-gjv4-4jgv | MEDIUM6.4 | kcp's impersonation allows access to global administrative groups | 11/12/2024 |